6.5

CVE-2026-85401

Exploit

Dolibarr Legacy File Manager config.inc.php access control

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt Dolibarr
Version 21.0.0
Status affected
Version 21.0.1
Status affected
Version 21.0.2
Status affected
Version 21.0.3
Status affected
Version 21.0.4
Status affected
Version 22.0.0
Status affected
Version 22.0.1
Status affected
Version 22.0.2
Status affected
Version 22.0.3
Status affected
Version 22.0.4
Status affected
Version 22.0.5
Status affected
Version 23.0.0
Status affected
Version 23.0.1
Status affected
Version 23.0.2
Status affected
Version 23.0.3
Status affected
Version 23.0.4
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.162
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@vuldb.com 2.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
cna@vuldb.com 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://github.com/Dolibarr/dolibarr/
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4
https://vuldb.com/vuln/398543
https://vuldb.com/vuln/398543/cti
https://vuldb.com/cve/CVE-2026-85401
https://vuldb.com/submit/894869
https://github.com/Dolibarr/dolibarr/issues/38963
https://github.com/Dolibarr/dolibarr/pull/39731
https://github.com/Dolibarr/dolibarr/commit/ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec